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Chapter 1 

An Analysis of Anonymity in the 

Bitcoin System 



Fergal Reid and Martin Harrigan 



Abstract 

Anonymity in Bitcoin, a peer-to-peer electronic currency system, is a com- 
plicated issue. Within the system, users are identified by public-keys only. An 
attacker wishing to de-anonymize its users will attempt to construct the one- 
to-many mapping between users and public-keys and associate information 
external to the system with the users. Bitcoin tries to prevent this attack by 
storing the mapping of a user to his or her public-keys on that user's node 
only and by allowing each user to generate as many public-keys as required. 
In this chapter we consider the topological structure of two networks derived 
from Bitcoin's public transaction history. We show that the two networks 
have a non-trivial topological structure, provide complementary views of the 
Bitcoin system and have implications for anonymity. We combine these struc- 
tures with external information and techniques such as context discovery and 
flow analysis to investigate an alleged theft of Bitcoins, which, at the time of 
the theft, had a market value of approximately half a million U.S. dollars. 

Key words: Network Analysis, Anonymity, Bitcoin 



1.1 Introduction 

Bitcoin is a peer-to-peer electronic currency system first described in a paper 
by Satoshi Nakamoto (a pseudonym) in 2008 [20 . It relies on digital sig- 
natures to prove ownership and a public history of transactions to prevent 
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2 Reid and Harrigan 

double-spending. The history of transactions is shared using a peer-to-peer 
network and is agreed upon using a proof-of-work system [131 IS] • 

The first Bitcoins were transacted in January 2009 and by June 2011 there 
were 6.5 mihion Bitcoins in circulation among an estimated 10,000 users [22]. 
In recent months, the currency has seen rapid growth in both media atten- 
tion and market price relative to existing currencies. At its peak, a single 
Bitcoin traded for more than US$30 on popular Bitcoin exchanges. At the 
same time, U.S. Senators and lobby groups in Germany, such as Der Bun- 
desverband Digitale Wirtschaft (BVWD) or the Federal Association of Digital 
Economy, have raised concerns regarding the untraceability of Bitcoins and 
their potential to harm society through tax evasion, money laundering and 
illegal transactions. The implications of the decentralized nature of Bitcoin 
for authorities' ability to regulate and monitor the flow of currency is as yet 
unclear. 

Many users adopt Bitcoin for political and philosophical reasons, as much 
as pragmatic ones. There is an understanding amongst Bitcoin's more tech- 
nical users that anonymity is not a promenient design goal of the system; 
however, opinions vary widely as to how anonymous the system is, in prac- 
tice. Jeff Garzik, a member of Bitcoin's development team, is quoted as saying 
it would be unwise "to attempt major illicit transactions with Bitcoin, given 
existing statistical analysis techniques deployed in the field by law enforce- 
ment"!^ however, prior to this work, no analysis of anonymity in Bitcoin was 
publicly available to substantiate or refute these claims. Furthermore, many 
other users of the system do not share this belief. For example, WikiLeaks, 
an international organization for anonymous whist leblowers, recently advised 
its Twitt er f ollowers that it now accepts anonymous donations via Bitcoin 
(see Fig. |l.l| ) and states thal[^ 

"Bitcoin is a secure and anonymous digital currency. Bitcoins cannot be easily 
tracked back to you, and are a [sic] safer and faster alternative to other donation 
methods." 

They proceed to describe a more secure method of donating Bitcoins that 
involves the generation of a one-time public-key but the implications for those 
who donate using the tweeted public-key are unclear. Is it possible to associate 
a donation with other Bitcoin transactions performed by the same user or 
perhaps identify them using external information? The extent to which this 
anonymity holds in the face of determined analysis remains to be tested. 

This chapter is organized as follows. In Sect. |1.2| we consider some ex- 
isting work relating to electronic currencies and anonymity. The economic 
aspects of the system, interesting in their own right, are beyond the scope 



of this work. In Sect. 1.3 we present an overview of the Bitcoin system; 



we focus on three features that are particularly relevant to our analysis. In 



^ http://www.theatlantic.com/technology/archive/2011/06/libertarian-dream-a-site- 

where-you-buy-drugs-with-digital-dollars/239776 - Retrieved 2011-11-12 
2 http://wikileaks.org/support.html - Retrieved: 2011-07-22 
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Fig. 1.1: Screen capture of a tweet from WikiLeaks announcing their acceptance of 'anony- 
mous Bitcoin donations'. 



Sect. 1.4 we construct two network structures, the transaction network and 



the user network using the publicly available transaction history. We study 



the static and dynamic properties of these networks. In Sect. |1.5| we consider 
the implications of these network structures for anonymity. We also combine 
information external to the Bitcoin system with techniques such as flow and 
temporal analysis to illustrate how various types of information leakage can 
contribute to the de-anonymization of the system's users. Finally, we conclude 
in Sect. ITS 



1.1.1 A Note Regarding Motivation and Disclosure 

Our motivation for this analysis is not to de-anonymize individual users of 
the Bitcoin system. Rather, it is to demonstrate, using a passive analysis 
of a publicly available dataset, the inherent limits of anonymity when using 
Bitcoin. This will ensure that users do not have expectations that are not 
being fulfilled by the system. 

In security-related research, there is considerable tension over how best 
to disclose vulnerabilities [9]. Many researchers favor full disclosure where 
all information regarding a vulnerability is promptly released. This enables 
informed users to promptly take defensive measures. Other researchers fa- 
vor limited disclosure; while this provides attackers with a window in which 
to exploit uninformed users, a mitigation strategy can be prepared and im- 
plemented before public announcement, thus limiting damage, e.g. through a 
software update. Our analysis illustrates some potential risks and pitfalls with 
regard to anonymity in the Bitcoin system. However, there is no central au- 
thority which can fundamentally change the system's behavior. Furthermore, 
it is not possible to mitigate analysis of the existing transaction history. 

There are also two noteworthy features of the dataset when compared with, 
say, contentious social network datasets, e.g. the Facebook profiles of Harvard 
University students [19]. Firstly, the delineation between what is considered 
public and private is clear: the entire history of Bitcoin transactions is publicly 
available. Secondly, the Bitcoin system does not have a usage policy. After 
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joining Bitcoin's peer-to-peer network, a client can freely request the entire 
history of Bitcoin transactions; there is no crawling or scraping required. 

Thus, we believe the best strategy to minimise the threat to user anonymity 
is to be descriptive about the risks of the Bitcoin system. We do not identify 
individual users - apart from those in the case study - but we note that it 
is not difficult for other groups to replicate our work. Indeed, given the pas- 
sive nature of the analysis, other parties may already be conducting similar 
analyses. 



1.2 Related Work 

The related work for this chapter can be categorized into two fields: electronic 
currencies and anonymity. 



1.2.1 Electronic Currencies 

Electronic currencies can be technically classified according to their mech- 
anisms for establishing ownership, protecting against double-spending, en- 
suring anonymity and/or privacy, and generating and issuing new currency. 
Bitcoin is particularly noteworthy for the last of these mechanisms. The 
proof-of-work system [131 E] that establishes consensus regarding the his- 
tory of transactions also doubles as a minting mechanism. The scheme was 
first outlined in the B-Money Proposal [12 . We briefiy consider some alterna- 
tive mechanisms. Ripple [14 is an electronic currency where every user can 
issue currency. However, the currency is only accepted by peers who trust 
the issuer. Transactions between arbitrary pairs of users require chains of 
trusted intermediaries between the users. Saito [25] formalized and imple- 
mented a similar system, i-WAT, in which the the chain of intermediaries 
can be established without their immediate presence using digital signatures. 
KARMA [29] is an electronic currency where the central authority is dis- 
tributed over a set of users that are involved in all transactions. PPay [30 is 
a micropayment scheme for peer-to-peer systems where the issuer of the cur- 
rency is responsible for keeping track of it. However, both KARMA and PPay 
may incur a large overhead when the rate of transactions is high. Mondex 
is a smart-card electronic currency [27 . It preserves a central bank's role in 
the generation and issuance of electronic currency. Mondex was an electronic 
replacement for cash in the physical world whereas Bitcoin is an electronic 
analog of cash in the online world. 

The authors are not aware of any studies of the network structure of elec- 
tronic currencies. However, there are such studies of physical currencies. The 
community currency Tomamae-cho was introduced into the Hokkaido Prefec- 
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ture in Japan for a three-month period during 2004-05 in a bid to revitahze 
local economy. The Tomamae-cho system involved gift-certificates that were 
re-usable and legally redeemable into yen. There was an entry space on the 
reverse of each certificate for recipients to record transaction dates, their 
names and addresses, and the purposes of use, up to a maximum of five re- 
cipients. Kichiji and Nishibe [17j used the collected certificates to derive a 
network structure that represented the fiow of currency during the period. 
They showed that the cumulative degree distribution of the network obeyed 
a power-law distribution, the network had small-world properties (the aver- 
age clustering coefficient was high whereas the average path length was low), 
the directionality and the value of transactions were significant features, and 
the double-triangle system ^ was effective. There also exist studies of the 
physical movement of currency: 'Where's George?' [1] is a crowd-sourced 
method for tracking U.S. dollar bills where users record the serial numbers of 
bills in their possession, along with their current location. If a bill is recorded 
sufficiently often, its geographical movement can be tracked over time. Brock- 
mann et al. [8 used this dataset as a proxy for studying multi-scale human 
mobility and as a tool for computing geographic borders inherent to human 
mobility. 

Grinberg [2 considers some of the legal issues that may be relevant to 
Bitcoin in the United States. For example, does Bitcoin violate the Stamp 
Payments Act of 1862? The currency can be used as a token for "a less sum 
than $1, intended to circulate as money or to be received or used in lieu of 
lawful money of the United States" . However, the authors of the act could not 
have conceived of digital currencies at the time of its writing and therefore 
Bitcoin may not fall under its scope. Grinberg believes that Bitcoin is unlikely 
to be a security or more specifically an "investment contract" and therefore 
does not fall under the Securities Act of 1933. He also believes that the Bank 
Secrecy Act of 1970 and the Money Laundering Control Act of 1986 pose 
the greatest risk for Bitcoin developers, exchanges, wallet providers, mining 
pool operators and businesses that accept Bitcoins. These acts require certain 
kinds of financial businesses, even if they are located abroad, to register with 
a bureau of the United States Department of the Treasury known as the 
Financial Crimes Enforcement Network (or FinCEN). The legality of Bitcoin 
is outside the scope of our work but is interesting nonetheless. 



1.2.2 Anonymity 

Previous work has shown the difficulty in maintaining anonymity in the con- 
text of networked data and online services which expose partial user informa- 
tion. Narayanan and Shmatikov [22 and Backstrom et al. [6 consider privacy 
attacks which identify users using the structure of networks and show the dif- 
ficulty in guaranteeing anonymity in the presence of network data. Crandall 
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et al. [11 infer social ties between users where none are explicitly stated by 
looking at patterns of 'co-incidences' or common off-network co-occurrences. 
Gross and Acquisiti [15 discuss privacy of early users in the Facebook so- 
cial network, and how information from multiple sources could be combined 
to identify pseudonymous network users. Narayanan and Shmatikov [21 de- 
anonymized the Netflix Prize dataset using information from IMDBJj which 
had similar user content, showing that statistical matching between different 
but related datasets can be used to attack anonymity. Puzis et al. [24 simu- 
lated the monitoring of a communications network using strategically- located 
monitoring nodes and showed that, using real- world network topologies, a rel- 
atively small number of nodes can collaborate to pose a significant threat to 
anonymity. Korolova et al. [18 study strategies for efficiently compromising 
network nodes, to maximise link information observed. Altshuler et al. [3 dis- 
cuss the increasing dangers of attacks targeting similar types of information, 
and provide measures of the difficulty of such attacks, on particular networks. 
All of this work points to the difficulty in maintaining anonymity where net- 
work data on user behaviour is available and illustrates how seemingly minor 
information leakages can be aggregated to pose significant risks. The security 
researcher Dan Kaminsky independently performed an investigation of some 
aspects of anonymity in the Bitcoin system, which he presented at a security 
conference [16j shortly after an initial draft of this work was made public. His 



work investigates the 'linking problem' we analyze in Sect. 1.4.2 In addition 
to the analysis we conducted, his work investigates the Bitcoin system from 
an angle we did not consider in our investigation - the TCP/IP operation 
of the underlying peer-to-peer network. Kaminsky's TCP/IP layer findings 
strengthen the core claims of this work that Bitcoin does not anonymise user 



activity. We provide a summary of his findings in Sect. 1.5.2 



1.3 The Bitcoin System 

The following is a simplified description of the Bitcoin system; see Nakamoto 
[20] for a more thorough treatment. Bitcoin is an electronic currency with 
no central authority or issuer. There is no central bank or fractional reserve 
system controlling the supply of Bitcoins. Instead, they are generated at a 
predictable rate such that the eventual total number will be 21 million. There 
is no requirement for a trusted third-party when making transactions. Sup- 
pose Alice wishes to 'send' a number of Bitcoins to Bob. Alice uses a Bitcoin 
client to join the Bitcoin peer-to-peer network and makes a public trans- 
action or declaration stating that one or more identities that she controls 
(which can be verified using public-key cryptography), and which previously 
had a number of Bitcoins assigned to them, wish to re-assign those Bitcoins 
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to one or more other identities, at least one of which is controhed by Bob. The 
participants of the peer-to-peer network form a cohective consensus regard- 
ing the vahdity of this transaction by appending it to the pubhc history of 
previously agreed-upon transactions (the block-chain). This process involves 
the repeated computation of a cryptographic hash function so that the digest 
of the transaction, along with other pending transactions, and an arbitrary 
nonce, has a specific form. This process is designed to require considerable 
computational effort, from which the security of the Bitcoin mechanism is 
derived. To encourage users to pay this computational cost, the process is 
incentivized using newly generated Bitcoins and/or transaction fees, and so 
this whole process is known as mining. 

In this chapter, there are three features of the Bitcoin system that are 
of particular interest. Firstly, the entire history of Bitcoin transactions is 
publicly available. This is necessary in order to validate transactions and 
prevent double-spending in the absence of a central authority. The only way 
to confirm the absence of a previous transaction is to be aware of all previous 
transactions. The second feature of interest is that a transaction can have 
multiple inputs and multiple outputs. An input to a transaction is either the 
output of a previous transaction or a sum of newly generated Bitcoins and 
transaction fees. A transaction frequently has either a single input from a 
previous larger transaction or multiple inputs from previous smaller transac- 
tions. Also, a transaction frequently has two outputs: one sending payment 
and one returning change. Thirdly, the payer and payee (s) of a transaction 
are identified through public-keys from public-private key-pairs. However, a 
user can have multiple public- keys. In fact, it is considered good practice for 
a payee to generate a new public-private key-pair for every transaction. Fur- 
thermore, a user can take the following steps to better protect their identity: 
they can avoid revealing any identifying information in connection with their 
public-keys; they can repeatedly send varying fractions of their Bitcoins to 
themselves using multiple (newly generated) public-keys; and/or they can 
use a trusted third-party mixer or laundry. However, these practices are not 
universally applied. 

The three features above, namely the public availability of Bitcoin trans- 
actions, the input-output relationship between transactions and the re-use 
and co-use of public-keys, provide a basis for two distinct network structures: 
the transaction network and the user network. The transaction network rep- 
resents the fiow of Bitcoins between transactions over time. Each vertex rep- 
resents a transaction and each directed edge between a source and a target 
represents an output of the transaction corresponding to the source that is 
an input to the transaction corresponding to the target. Each directed edge 
also includes a value in Bitcoins and a timestamp. The user network repre- 
sents the flow of Bitcoins between users over time. Each vertex represents 
a user and each directed edge between a source and a target represents an 
input-output pair of a single transaction where the input's public- key belongs 
to the user corresponding to the source and the output's public-key belongs 
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to the user corresponding to the target. Each directed edge also includes a 
value in Bitcoins and a timestamp. 

We gathered the entire history of Bitcoin transactions from the first trans- 
action on the 3^^ January 2009 up to and including the last transaction 
that occurred on the 12*^ July 2011. We gathered the dataset using the 
Bitcoin clienl|3 and a modified version of Gavin Andresen's bitcointools 
projectjj The dataset comprises 1019486 transactions between 1253 054 
unique public-keys. We describe the construction of the corresponding trans- 
action and user networks and their analyses in the following sections. We 
will show that the two networks are complex, have a non-trivial topologi- 
cal structure, provide complementary views of the Bitcoin system and have 
implications for the anonymity of users. 



1.4 The Transaction and User Networks 
1.4.-1 The Transaction Network 

The transaction network T represents the fiow of Bitcoins between trans- 
actions over time. Each vertex represents a transaction and each directed 
edge between a source and a target represents an output of the transaction 
corresponding to the source that is an input to the transaction correspond- 
ing to the target. Each directed edge also includes a value in Bitcoins and a 
timestamp. It is a straight-forward task to construct T from our dataset. 



... t, has 12 other 
inputs not shown here 




Fig. 1.2: An example sub-network from the transaction network. Each rectangular vertex 

represents a transaction and each directed edge represents a flow of Bitcoins from an output 

of one transaction to an input of another. 

^ http://www.bitcoin.org 

^ http://github.com/gavinandresen/bitcointools 
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Figure 1.2 shows an example sub- network of T. ti is a transaction with 
one input and two outputs jj It was added to the block-chain on the 1®* May 
2011. One of its outputs assigned 1.2 BTC (Bitcoins) to a user identified by 



the public-key pki^ The public-keys are not shown in Fig. L2 Similarly, ^2 



is a transaction with two inputs and two outputs Jj It was accepted on the 5 
May 2011. One of its outputs sent 0.12 BTC to a user identified by a different 
public-key, pA:2Jjt3 is a transaction with two inputs and one output}^ It was 
accepted on the 5*^ May 2011. Both of its inputs are connected to the two 
aforementioned outputs of ti and ^2- The only output of ts was redeemed by 

T has 974 520 vertices and 1 558 854 directed edges. The number of vertices 
is less than the total number of transactions in the dataset because we omit 
transactions that are not connected to at least one other transaction. These 
correspond to newly generated Bitcoins and transactions fees that are not 
yet redeemed. The network has neither multi-edges (multiple edges between 
the same pair of vertices in the same direction) nor loops. It is a directed 
acyclic graph (DAG) since the output of a transaction can never be an input 
(either directly or indirectly) to the same transaction. 



Figure 1.3(a)| shows a log-log plot of the cumulative degree distributions: 



the solid red curve is the cumulative degree distribution (in- and out-degree); 
the dashed green curve is the cumulative in-degree distribution; and the dot- 
ted blue curve is the cumulative out-degree distribution. We fitted power-law 
distributions, p{x) ~ x~^ for x > Xmim to the three distributions by es- 
timating the parameters a and x^nin using a goodness-of-fit method [10] . 
Table |1.1| shows the estimates along with the corresponding Kolmogorov- 
Smirnov goodness-of-fit (GoF) statistics and p- values. We observe that none 
of the distributions for which the empirically-best scaling region is non-trivial 
have a power-law as a plausible hypothesis {p > 0.1). This is likely due to 
the fact that there is no preferential attachment [26l [7]: new vertices are 
joined to existing vertices whose corresponding transactions are not yet fully 
redeemed. 

There are 1 949 (maximal weakly) connected components in the network. 



Fig. 1 1.3(b) shows a log- log plot of the cumulative component size distribution. 



There are 948 287 vertices (97.31%) in the giant component. This component 



^ The transactions and public-keys used in our examples ex- 
ist in our dataset. The unique identifier for the transaction ti is 
09441d3c52fa0018365fcd2949925182f6307322138773d52c201f5cc2bb5976. You can query 
the details of a transaction or public-key by examining Bitcoin's block-chain using, say, 
the Bitcoin Block Explorer (http://www.blockexplorer.com). 
^ 13eBhR3oHFD5wkE4oGtrLdbdi2PvK3ijMC 

8 0c4d41d0f5d2affl4d449daa550c7d9b0eaaf35d81ee5e6e77f8948bl4d62378 

9 19smBSUoRGmbH13viflNul7S63Tnmg7h9n 

10 0c034fb964257ecbf4eb953e2362el65dea9cld008032bc9ece5cebbc7cd4697 

11 fl6ece066f6e4cf92d9a72ebl359d8401602a23990990cb84498cdbb93026402 
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Fig. 1.3: For the transaction network: (a) A log-log plot of the cumulative degree distri- 
butions, (b) A log-log plot of the cumulative component size distribution, (c) A temporal 
histogram showing the number of edges per month, (d) A temporal histogram showing the 
density per month, (e) A temporal histogram showing the average path length per month. 



also contains a giant biconnected component with 716 354 vertices (75.54% 
of the vertices in the giant component). 

Variable x x s o; Xmin GoF p-val. 



Degree 3 3.20 6.20 3.24 50 0.02 0.05 

In-Degree 1 1.60 5.31 2.50 4 0.01 0.00 

Out-Degree 1 1.60 3.17 3.50 51 0.05 0.00 



Table 1.1: The degree, in-degree and out-degree distributions of T. 
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We also performed a rudimentary dynamic analysis of the network. Fig- 



ures [L3(cH[L3(dJ and 1.3(e) show the edge number, density and average path 
length of the transaction network on a monthly basis. These measurements 
are not cumulative. The network's growth and sparsification are evident. We 
also observe some anomalies in the average path length during July and 
November 2010. 



1.4.2 The User Network 

The user network U represents the flow of Bitcoins between users over time. 
Each vertex represents a user and each directed edge between a source and 
a target represents an input-output pair of a single transaction where the 
input's public-key belongs to the user corresponding to the source and the 
output's public-key belongs to the user corresponding to the target. Each 
directed edge also includes a value in Bitcoins and a timestamp. 

We need to perform a preprocessing step before we can construct hi from 
our dataset. Suppose hi is, at first, incomplete in the sense that each ver- 
tex represents a single public-key rather than a user and that each directed 
edge between a source and a target represents an input-output pair of a sin- 
gle transaction, where the input's public-key corresponds to the source and 
the output's public-key corresponds to the target. In order to perfect this 
network, we need to contract each subset of vertices whose corresponding 
public-keys belong to a single user. The difficulty is that public-keys are Bit- 
coin's mechanism for ensuring anonymity: 'the public can see that someone 
[identified by a public-key] is sending an amount to someone else [identified by 
another public-key], but without information linking the transaction to any- 
one.' [20]. In fact, it is considered good practice for a payee to generate a new 
public-private key-pair for every transaction to keep transactions from being 
linked to a common owner. Therefore, it is impossible to completely perfect 
the network using our dataset alone. However, as noted by Nakamoto [20 , 

"Some linking is still unavoidable with multi-input transactions, which necessarily 
reveal that their inputs were owned by the same owner. The risk is that if the owner 
of a key is revealed, linking could reveal other transactions that belonged to the 
same owner." 

We will use this property of transactions with multiple inputs to contract 
subsets of vertices in the incomplete network. We construct an ancillary net- 
work in which each vertex represents a public-key. We connect pairs of vertices 
with undirected edges, where each edge joins a pair of public keys that are 
both inputs to the same transaction and are thus controlled by the same 
user. From our dataset, this ancillary network has 1253 054 vertices (unique 
public-keys) and 4 929 950 edges. More importantly, it has 86 641 non-trivial 
maximal connected components. Each maximal connected component in this 
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graph corresponds to a user, and each component's constituent vertices cor- 
respond to that user's pubhc-keys. 



Cumulative Deg. Dist. of the User Network 
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Fig. 1.4: For the user network: (a) A log-log plot of the cumulative degree distributions. 
(b) A log-log plot of the cumulative component size distribution, (c) A temporal histogram 
showing the number of edges per month, (d) A temporal histogram showing the density 
per month, (e) A temporal histogram showing the average path length per month. 



Figure 1.5 shows an example sub-network of the incomplete network over- 



laid onto the example sub-network of T from Fig. |1.2[ The outputs of ti and 
^2 that were eventually redeemed by ts were sent to a user whose public-key 
was pki and a user whose public-key was pk2 respectively. Figure 1.6 shows 



an example sub-network of the user network overlaid onto the example sub- 



network of the incomplete network from Fig. 1.5 pki and pk2 are contracted 
into a single vertex ui since they correspond to a pair inputs of a single trans- 
action. In other words, they are in the same maximal connected component of 



1.4 The Transaction and User Networks 
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Fig. 1.5: An example sub-network from the incomplete network. Each diamond vertex 
represents a public-key and each directed edge between diamond vertices represents a flow 
of Bitcoins from one public-key to another. 




Fig. 1.6: An example sub-network from the user network. Each circular vertex represents 
a user and each directed edge between circular vertices represents a flow of Bitcoins from 
one user to another. The maximal connected component from the ancillary network that 
corresponds to the vertex ui is shown within the dashed grey box. 



the ancillary network (see the vertices representing pki and pk2 in the dashed 
grey box in Fig. 1.6). A single user owns both public-keys. We note that the 



maximal connected component in this case is not simply a clique; it has a 
diameter of four indicating that there are at least two public-keys belonging 
to that same user that are connected indirectly via three transactions. The 
sixteen inputs to transaction t^ result in the contraction of a further sixteen 
public-keys into a single vertex U2. The value and timestamp of the flow of 
Bitcoins from ui to U2 is derived from the transaction network. 
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After the preprocessing step, hi has 881678 vertices (86 641 non-trivial 
maximal connected components and 795 037 isolated vertices in the ancillary 
network) and 1 961 636 directed edges. The network is still incomplete. We 
have not contracted all possible vertices but it will suffice for our present 
analysis. Unlike T, hi has multi-edges, loops and directed cycles. 

Figure 1.4(a) [ shows a log-log plot of the network's cumulative degree dis- 



tributions. We fitted power-law distributions to the three distributions and 
calculated their goodness-of-fit and statistical significance as in the previous 
section. Table [L2l shows the results. We observe that none of the distributions 
have a power-law as a plausible hypothesis. 

There are 604 (maximal) weakly connected components and 579 355 (max- 



imal) strongly connected components in the network; Fig. 1.4(b) shows a log- 
log plot of the cumulative component size distribution for both variations. 
There are 879 859 vertices (99.79%) in the giant weakly connected compo- 
nent. This component also contains a giant weakly biconnected component 
with 652 892 vertices (74.20% of the vertices in the giant component). 

Variable x x so; Xmin GoF p-val. 



Degree 3 4.45 218.10 2.38 66 0.02 0.00 

In-Degree 1 2.22 86.40 2.45 57 0.05 0.00 
Out-Degree 2 2.22 183.91 2.03 10 0.22 0.00 

Table 1.2: The degree, in-degree and out-degree distributions oiU. 



Our dynamic analysis of the user network mirrors that of the transaction 
network in the previous subsection. Figures |1.4(c)[ |1.4(d)| and |1.4(e)| show 
the edge number, density and average path length of the user network on 
a monthly basis. These measurements are not cumulative. The network's 
growth and sparsification are evident. We note that even though our dynamic 
analysis of the user network is on a monthly basis, the preprocessing step is 
performed using the ancillary network of the entire incomplete network. This 
enables us to resolve public-keys to a single user irrespective of the month in 
which the linking transactions occur. 

The contraction of public-keys into users, while incomplete, generates a 
network that is in many ways a proxy for the social network of Bitcoin users. 
The edges represent financial transactions between pairs of users. It may be 
possible to identify, for example, communities, central users and hoarders 
within this social network. 
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1.5 Anonymity Analysis 

Prior to performing the analyses above, we expected the user network to be 
largely composed of trees representing Bitcoin flows between one-time public- 
keys that were not linked with other public-keys. However, our analyses reveal 
that the user network has considerable cyclic structure. We now consider 
the implications of this structure, coupled with other aspects of the Bitcoin 
system, for anonymity. 

There are several ways in which the user network can be used to deduce 
information about Bitcoin users. We can use global network properties, such 
as degree distribution, to identify outliers. We can use local network proper- 
ties to examine the context in which a user operates by observing the users 
with which he or she interacts with either directly or indirectly. The dynamic 
nature of the user network also enables us to perform flow and temporal anal- 
yses. We can examine the significant Bitcoin flows between groups of users 
over time. We will now discuss each of these possibilities in more detail and 
provide a case study to demonstrate their use in practice. 



1.5.1 Integrating Off-Network Information 

There is no user directory for the Bitcoin system. However, we can attempt 
to build a partial user directory associating Bitcoin users (and their known 
public-keys) with off-network information. If we can make sufficient associ- 
ations and combine them with the network structures above, a potentially 
serious threat to anonymity emerges. 

Many organizations and services such as on-line stores that accept Bit- 
coins, exchanges, laundry services and mixers have access to identifying in- 
formation regarding their users, e.g. e-mail addresses, shipping addresses, 
credit card and bank account details, IP addresses, etc. If any of this infor- 
mation is publicly available, or accessible by, say, law enforcement agencies, 
then the identities of users involved in related transactions may also be at 
risk. To illustrate this point, we consider a number of publicly available data 
sources and integrate their information with the user network. 



1.5.1.1 The Bitcoin Faucet 

The Bitcoin Faucelrn is a website where users can donate Bitcoins to be 
redistributed in small amounts to other users. In order to prevent abuse of 
this service, a history of recent give-aways are published along with the IP 
addresses of the recipients. When the Bitcoin Faucet does not batch the re- 



^'^ http://freebitcoins.appspot.com 
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distribution, it is possible to associate the IP addresses with the recipient's 
pubhc-keys. This page can be scraped over time to produce a time-stamped 
mapping of IP addresses to users. 

We found that the pubhc-keys associated with many of the IP addresses 
that received Bitcoins were contracted with other pubhc-keys in the ancihary 
network, thus reveahng IP addresses that are somehow related to previous 
transactions. Fig. 1.7(a) shows a map of geolocated IP addresses belonging to 
users who received Bitcoins over a period of one week. Fig. 1 1.7(b)] over lays the 
user network onto a sample of those users. An edge between two geolocated IP 
addresses indicates that the corresponding users are linked by an undirected 
path of length at most three in the user network; the path must not contain 
the vertex representing the Bitcoin Faucet itself. 

These figures serve as a proof-of-concept from a small publicly available 
data source. We note that large centralized Bitcoin service providers are 
capable of producing much more detailed maps. 




Fig. 1.7: We can use the Bitcoin Faucet to map users to geolocated IP addresses, (a) A 
map of geolocated IP addresses associated with users receiving Bitcoins from the Bitcoin 
Faucet during a one week period, (b) A map of a sample of the geolocated IP addresses in 
I (a) [ connected by edges where the corresponding users are connected by a path of length at 
most three in the user network that does not include the vertex representing the Bitcoin 
Faucet. 



1.5.1.2 Voluntary Disclosures 



Another source of identifying information is the voluntary disclosure of 
public-keys by users, for example, when posting to the Bitcoin forumj^ 
Bitcoin public-keys are typically represented as strings approximately thirty- 
three characters in length and starting with the digit one. They are indexed 
very well by popular search engines. We identified many high-degree vertices 
with external information using a search engine alone. We scraped the Bit- 
coin Forums where users frequently attach a public-key to their signatures. 



http://forum.bitcoin.org 
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We also gathered public-keys from Twitter streams and user-generated public 
directories. It is important to note that in many cases we are able to resolve 
the 'public' public-keys with other public-keys belonging to the same user us- 
ing the ancillary network. We also note that large centralized Bitcoin service 
providers can do the same with their user information. 



1.5.2 TCP/IP Layer Information 

Security researcher Dan Kaminsky has performed an analysis of the Bitcoin 
system, investigating identity leakage at the TCP/IP layer. He found that by 
opening a connection to all public peers in the network at once, he could map 
IP addresses to Bitcoin public-keys, working from the assumption that "the 
first node to inform you of a transaction is the source of it. . . [this is] more or 
less true, and absolutely over time" [16]. Using this approach it is possible to 
map public-keys to IP addresses unless users are using an anonymising proxy 
technology such as TOR. 



1.5.3 Egocentric Analysis and Visualization 

There are severals pieces of information we can directly derive from the user 
network regarding a particular user. We can compute the balance held by 
a single public-key. We can also aggregate the balances belonging to public- 
keys that are controlled by a particular user. For example. Fig. |1.8(a) and 



Fig. 1.8(b) show the receipts and payments to and from WikiLeaks' public- 
key in terms of Bitcoins and the number of transactions respectively. The 
donations are relatively small and are forwarded to other public-keys period- 
ically. There was also a noticeable spike in donations when the facility was 



first announced. Figure 1.8(c) shows the receipts and payments to and from 
the creator of a popular Bitcoin trading website aggregated over a number 
of public-keys that are linked through the ancillary network. 

An important advantage of deriving network structures from the Bitcoin 
transaction history is our ability to use network visualization and analysis 



tools to investigate the flow of Bitcoins. For example. Fig. |1.9| shows the net- 
work structure surrounding the WikiLeaks' public-key in the incomplete user 
network. Our tools resolve several of the vertices with identifying information 
gathered in Sect.[T3]T] These users can be linked either directly or indirectly 
to their donations. 
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(a) The receipts and payments to and 
from WikiLeaks' public- key over time. 



(b) The number of transactions involv- 
ing WikiLeaks' public-key over time. 
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(c) The receipts and payments to and 
from the creator of a popular Bitcoin 
trading website aggregated over a num- 
ber of public-keys. 

Fig. 1.8: We can plot cumulative receipts and payments to and from Bitcoin public- keys 
and users. 



1.5.^ Context Discovery 



Given a number of public-keys or users of interest, we can use network struc- 
ture and context to better understand the flow of Bitcoins between them. 
For example, we can examine all shortest paths between a set of vertices or 
consider the maximum number of Bitcoins that can flow from a source to 
a destination given the transactions and their 'capacities' in an interesting 



time-window. For example. Fig. 1.10 shows all shortest paths between the 
verti ces rep resenting the users we identified using off-network information in 
Sect. 1.5.l| and the vertex that represents the MyBitcoin servicq^in the user 
network. We can identify more than 60% of the users in this visualization 
and deduce many direct and indirect relationships between them. 



http://www.mybitcoin.com 
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Fig. 1.9: An egocentric visualization of the vertex representing WikiLeaks' public-key in 
the incomplete user network. The size of a vertex corresponds to its degree in the entire 
incomplete user network. The color denotes the volume of Bitcoins - warmer colors have 
larger volumes flowing through them. The three largest red vertices represent a Bitcoin 
mining pool, a centralized Bitcoin wallet service, and an unknown entity. 



Case Study - Part I: We analyse an alleged theft of 25 000 BTC reported 
in the Bitcoin Forum j^ by a user known as allinvain. The victim reported 
that a large portion of his Bitcoins were sent to p/crecFj on 13/06/2011 at 
16:52:23 UTC. The theft occurred shortly after somebody broke into the 
victim's Slush pool accounlp^ and changed the payout address to pfe^/^eF^ 
The Bitcoins rightfully belonged to p/cc^reenFj At the time of theft, the stolen 
Bitcoins had a market value of approximately half a million U.S. dollars. We 
chose this case study to illustrate the potential risks to the anonymity of a 
user (the thief) who has good reason to remain anonymous. 

We consider the incomplete user network before any contractions. We re- 
strict ourselves to the egocentric network surrounding the thief: we include 
every vertex that is reachable by a path of length at most two ignoring direc- 
tionality and all edges induced by these vertices. We also remove all loops, 
multiple edges and edges that are not contained in some biconnected com- 
ponent to avoid clutter. In Fig. |1.11[ the red vertex represents the thief who 



^^ http: //forum. bitcoin. org/index.php?topic=16457.0 
16 lKPTdMb6p7H3YCwsyFqrEmKGmsHqelQ3jg 
^^ http://mining.bitcoin.cz 

18 15iUDqk6nLmav3BlxUHPQivDpfMruVsu9f 

19 lJ18yk7D353z3gRVcdbS7PV5Q8h5w6oWWG 
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Fig. 1.10: A visualisation of all users identified in Sect. |l.5.l| and all shortest paths between 
the vertices representing those users and the vertex representing the MyBitcoin service in 
the user network. 
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Fig. 1.11: An egocentric visualization of the thief in the incomplete user network. For this 
visualization, vertices are colored according to the text, edges are colored according to the 
color of their sources and the size of each vertex is proportional to its edge-betweenness 
within the egocentric network. 
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owns the public-key pkred and the green vertex represents the victim who 
owns the pubhc-key pkgreen- The theft is represented by a green edge joining 
the victim to the thief. 



0.31337 BTC 
17:45:31 13/06/2011 




1 BTC 

17:34:04 13/06/2011 

25000 BTC 
17:52:23 13/06/2011 



/ 

/ J 

( 60 transactions involving 441.83 .5 

\ BTC over a 70-day period | 

\ 

\ 



Bit coins sent from Purpl< 




Fig. 1.12: An interesting sub-network induced by the thief, the victim and three other 
vertices. The notation is the same as in Fig. 11. Ill 



Interestingly, the victim and the thief are joined by paths (ignoring di- 
rectionahty) other than the green edge representing the theft. For example, 



consider the sub-network shown in Fig. |1.12| induced by the red, green, pur- 
ple, yellow and orange vertices. This sub-network is a cycle. We contract all 
vertices whose corresponding public-keys belong to the same user. This al- 
lows us to attach values in Bitcoins and timestamps to the directed edges. We 
can make a number of observations. Firstly, we note that the theft of 25 000 
BTC was preceded by a smaller theft of 1 BTC. This was later reported by 
the victim in the Bitcoin forums. Secondly, using off- network data, we have 
identified some of the other colored vertices: the purple vertex represents 
the main Slush pool account and the orange vertex represents the computer 
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hacker group known as LulzSecj^ We note that there has been at least one 
attempt to associate the thief with LulzSecp^ This was a fake; it was created 
after the theft. However, the identification of the orange vertex with LulzSec 
is genuine and was established before the theft. We observe that the thief 
sent 0.31337 BTC to LulzSec shortly after the theft but we cannot otherwise 
associate him with the group. The main Slush pool account sent a total of 
441.83 BTC to the victim over a 70-day period. It also sent a total of 0.2 
BTC to the yellow vertex over a two day period. One day before the theft, 
the yellow vertex also sent 0.120607 BTC to LulzSec. 

The yellow vertex represents a user who is the owner of at least five public- 
keys j^ Like the victim, he is a member of the Slush pool, and like the thief, 
he is a one-time donator to LulzSec. This donation, the day before the theft, 
is his last known activity using these public-keys. 



1.5.5 Flow and Temporal Analyses 

In addition to visualizing egocentric networks with a fixed radius, we can 
follow significant fiows of value through the network over time. If a vertex 
representing a user receives a large volume of Bitcoins relative to their esti- 
mated balance, and, shortly after, transfers a significant proportion of those 
Bitcoins to another user, we deem this interesting. We built a special purpose 
tool that, starting with a chosen vertex or set of vertices, traces significant 
fiows of Bitcoins over time. In practice we have found this tool to be quite 
revealing when analyzing the user network. 

Case Study - Part II: To demonstrate this tool we re-consider the Bitcoin 
theft described earlier. We note that the victim has developed their own 
tool to generate an exhaustive list of public-keys that have received some 
portion of the stolen Bitcoins since the t heft p^ However, this list grows very 
quickly and, at the time of writing, contained more than 34 100 public-keys. 
Figure |1.13| shows an annotated visualization produced using our tool. We 



observe several interesting fiows in the aftermath of the theft. The initial 
theft of a small volume of 1 BTC is immediately followed by the theft of 
25 000 BTC. This is represented as a dotted black line between the relevant 
vertices, magnified in the left inset. 



20 http://twitter.com/LulzSec/status/76388576832651265 

21 http://pastebin.com/88nGp508 

22 lMUpbAY7rjWxvLtUwLkARViqSdzypMgVW4 
13tst9ukW294Q7f6zRJr3VmLq6zplC68EK 
lDcQvXMD87MaYcFZqHzDZyH3sAv8R5hMZe 
lAEW9ToWWwKoLFYSsLkPqDyHeS2feDVsVZ 
lEWASKF9DLUCgEFqfgrNaHzp3q4oEgjTsF 

2^ http://folk.uio.no/vegardno/aninvain-addresses.txt 
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Fig. 1.13: Visualisation of Bitcoin flow from the alleged theft. The left inset shows the 
initial shuflling of Bitcoins among accounts close to that of the alleged thief. The right 
inset shows the flow of Bitcoins during several subsequent days. The flows split and ater 
merge, validating that the flows found by the tool are probably still controlled by a single 
user. 



In the left inset, we can see that the Bitcoins are shuffled between a smah 
number of accounts and then transferred back to the initial account. After 
this shuffling step, we have identified four significant outflows of Bitcoins that 
began at 19:49, 20:01, 20:13 and 20:55. Of particular interest are the outflows 
that began at 20:55 (labeled as '1' in both insets) and 20:13 (labeled as '2' in 
both insets). These outflows pass through several subsequent accounts over 
a period of several hours. Flow 1 splits at the vertex labeled A in the right 
inset at 04:05 on the day after the theft. Some of its Bitcoins rejoin Flow 2 
at the vertex labeled B. This new combined flow is labeled as '3' in the right 
inset. The remaining Bitcoins from Flow 1 pass through several additional 
vertices in the next two days. This flow is labeled as '4' in the right inset. 

A surprising event occurs on 16/06/2011 at approximately 13:37. A small 
number of Bitcoins are transferred from Flow 3 to a heretofore unseen public- 
key p/ci 1^ Approximately seven minutes later, a small number of Bitcoins 
are transferred from Flow 3 to another heretofore unseen public-key pfe2p^ 
Finally, there are two simultaneous transfers from Flow 4 to two more hereto- 
fore unseen public-keys: pfe j^ and p/c4|^We have determined that these four 
public-keys, p/ci, p/c2, pks and pk^ - which receive Bitcoins from two sepa- 
rate flows that split from each other two days previously - are all contracted 



24 lFKFiCYJSFqxT3zkZntHjfU47SvAzauZXN 

25 lFhYawPhWDvkZCJVBrDfQoo2qC3EuKtb94 

26 lMJZZmmSrQZ9NzeQt3hYP76oFC5dWAf2nD 
2'^ 12dJol7jcR78UklAk5wfgyXtciU62MzcEc 
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to the same user in our ancillary network. This user is represented as C in 



Fig. 1.13 



There are several other examples of interesting flow. The flow labeled as Y 
involves the movement of Bitcoins through thirty unique public-keys in a very 
short period of time. At each step, a small number of Bitcoins (typically 30 
BTC which had a market value of approximately US$500 at the time of the 
transactions) are siphoned off. The public-keys that receive the small number 
of Bitcoins are typically represented by small blue vertices due to their low 
volume and degree. On 20/06/2011 at 12:35, each of these public-keys makes 
a transfer to a public-key operated by the MyBitcoin servicej^ Curiously, 
this public-key was previously involved in another separate Bitcoin theflp^ 







^^^^f^ft;^. 



Fig. 1.14: The Bitcoins are transferred between public- keys along the highlighted paths 
very quickly. 



We also observe that the Bitcoins in many of the above flows are trans- 



ferred between public-keys very quickly. Fig. 1.14 shows two flows in partic- 
ular where the intermediate parties waited for very few confirmations before 
re-sending the Bitcoins to other public-keys. 

Much of this analysis is circumstantial. We cannot say for certain whether 
or not these flows imply a shared agency in both incidents. However, it does 
illustrate the power of our tool when tracing the flow of Bitcoins and gener- 
ating hypotheses. It also suggests that a centralized service may have further 
details on the user(s) in control of the implicated public-keys. 

28 lMAazCWMydsQB5ynYXqSGQDjNQMN3HFmEu 
2^ http: //forum. bitcoin. org/index.php?topic=20427.0 
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1.5.6 Other Forms of Analysis 

There are many other forms of analysis that can be apphed in order to de- 
anonymize the workings of the Bitcoin system: 

• Many transactions have two outputs: one is the payment from a payer to 
a payee and the other is the return of change to the payer. If we assume 
that a transaction was created using a particular client implementation 
and we have access to the client's source code, then we may be able to 
deduce, in some cases, which was the output and which was the change. 
We can then map the public-key that the change was assigned to back to 
the user who created the transaction. 

• Order books for Bitcoin exchanges are typically available to support trad- 
ing tools. As orders are often placed in Bitcoin values converted from 
other currencies, they have a precise decimal value with eight significant 
digits. It may be possible to find transactions with corresponding amounts 
and thus map public-keys and transactions to the exchanges. 

• Over an extended time period, several public-keys, if used at similar 
times, may belong to the same user. It may be possible to construct 
and cluster a co-occurrence network to help deduce mappings between 
public-keys and users. 

• Finally, there are far more sophisticated forms of attack where the at- 
tacker actively participates in the network, for example, using marked 
Bitcoins or by operating a laundry service. 



1.5.7 Mitigation Strategies 

In addition to educating users about the limits of anonymity in the Bit- 
coin system, some risks to privacy could potentially be mitigated by making 
changes to the system. A patch to the official Bitcoin client has been devel- 
opeq^ which allows users to prevent the linking of public-keys by making 
the user aware of potential links within the Bitcoin client user-interface. It is 
also possible for the client to automatically proxy Bitcoins through dummy 
public-keys. This would come at the cost of increased transaction fees but 
would increase deniability and obfuscate the chain of transaction histories. 
Finally, if a future version of the protocol supported protocol-level mixing of 
Bitcoins, this would increase the difficulty for a passive third-party to track 
individual user histories. 



^^ http://coderrr.wordpress.com/2011/06/30/patching-the-bitcoin-client-to-make- it- 

more-anonymous - Retrieved 2011-11-04 
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1.6 Conclusions 

For the past half-century futurists have heralded the advent of a cash-less 
society |4j. Many of their predictions have been realized, e.g. Anderson et 
al.'s [4]'s 'on-line real-time' payment system and bank-maintained 'central 
information files'. However, cash is still a competitive and relatively anony- 
mous means of payment. Bitcoin is an electronic analog of cash in the online 
world. It is decentralized: there is no central authority responsible for the 
issuance of Bitcoins and there is no need to involve a trusted third-party 
when making online transfers. However, this flexibility comes at a price: the 
entire history of Bitcoin transactions is publicly available. In this chapter we 
investigated the structure of two networks derived from this dataset and their 
implications for user anonymity. 

Using an appropriate network representation, it is possible to associate 
many public-keys with each other, and with external identifying information. 
With appropriate tools, the activity of known users can be observed in detail. 
This can be performed using a passive analysis only. Active analyses, where 
an interested party can potentially deploy 'marked' Bitcoins and collaborate 
with other users can discover even more information. We also believe that 
large centralized services such as the exchanges and wallet services are capable 
of identifying and tracking considerable portions of user activity. 

Technical members of the Bitcoin community have cautioned that strong 
anonymity is not a prominent design goal of the Bitcoin system. However, 
casual users need to be aware of this, especially when sending Bitcoins to 
users and organizations they would prefer not to be publicly associated with. 
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